System And Method For Analyzing Data Records

ABSTRACT

Systems and methods for analyzing input data records are provided in which a master process initiates a plurality of concurrent first processes each of which comprises, for each data record in at least a subset of a plurality of input data records, creating a parsed representation of the data record and independently applying a procedural language query to the parsed representation to extract one or more values. A respective emit operator is applied to at least one of the extracted one or more values thereby adding corresponding information to a respective intermediate data structure. The respective emit operator implements one of a predefined set of statistical information processing functions. The master process also initiates a plurality of second processes each of which aggregates information from a corresponding subset of intermediate data structures to produce aggregated data that is, in turn, combined to produce output data.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.15/226,795, filed Aug. 2, 2016, which is a continuation of U.S. patentapplication Ser. No. 13/407,632, filed Feb. 28, 2012, now U.S. Pat. No.9,405,808, which is a continuation of U.S. patent application Ser. No.12/533,955, filed Jul. 31, 2009, now U.S. Pat. No. 8,126,909, which is acontinuation of U.S. patent application Ser. No. 10/954,692, filed Sep.29, 2004, now U.S. Pat. No. 7,590,620, which is a continuation-in-partof U.S. application Ser. No. 10/871,244, filed Jun. 18, 2004, now U.S.Pat. No. 7,650,331, each of which is incorporated herein by reference inits entirety.

TECHNICAL FIELD

The disclosed embodiments relate generally to data processing systemsand methods, and in particular to a framework for simplifyinglarge-scale data processing and analyzing data records.

BACKGROUND

Large-scale data processing involves extracting data of interest fromraw data in one or more datasets and processing it into a useful dataproduct. The implementation of large-scale data processing in a paralleland distributed processing environment typically includes thedistribution of data and computations among multiple disks andprocessors to make efficient use of aggregate storage space andcomputing power.

Various languages and systems provide application programmers with toolsfor querying and manipulating large datasets. These conventionallanguages and systems, however, fail to provide support forautomatically parallelizing these operations across multiple processorsin a distributed and parallel processing environment. Nor do theselanguages and systems automatically handle system faults (e.g.,processor failures) and I/O scheduling. Nor do these languages andsystems efficiently handle the analysis of data records.

SUMMARY

A method and system for analyzing data records includes allocatinggroups of records to respective processes of a first plurality ofprocesses executing in parallel. In each respective process of the firstplurality of processes, for each record in the group of recordsallocated to the respective process, a query is applied to the record soas to produce zero or more values. Zero or more emit operators areapplied to each of the zero or more produced values so as to addcorresponding information to an intermediate data structure. Informationfrom a plurality of the intermediate data structures is aggregated toproduce output data.

One aspect of the present disclosure provides a computer-implementedmethod of analyzing a plurality of input data records in which a masterprocess is executed that forms a procedure comprising initiating aplurality of first processes. Each respective process of the pluralityof first processes is executed concurrently by the master process andcomprises, for each data record in at least a subset of the plurality ofinput data records, creating a parsed representation of the data record,applying a procedural language query to the parsed representation of thedata record to extract one or more values, where the procedural languagequery is applied independently to each parsed representation, andapplying a respective emit operator to at least one of the extracted oneor more values to add corresponding information to a respectiveintermediate data structure, wherein the respective emit operatorimplements one of a predefined set of statistical information processingfunctions. The master process further initiates a plurality of secondprocesses. Each respective process of the plurality of second processesaggregates information from a corresponding subset of the intermediatedata structures to produce aggregated data. The computer implementedmethod further combines the produced aggregated data to produce outputdata.

In some embodiments, each process in the first plurality of processes iscompiled into a binary file prior to execution. In some embodiments,each process in the first plurality of processes is implemented as auser defined object in accordance with an object oriented programmingtechnique. In some embodiments, each process in the first plurality ofprocesses is implemented as a user defined object that is derived from abase class in accordance with an object oriented programming technique.

In some embodiments, the initiating the plurality of first processcomprises creating a respective object in a plurality of object for eachfirst process in the plurality of first processes.

In some embodiments, the master process combines the produced aggregateddata to produce output data.

In some embodiments, the respective emit operator implements one of apredefined set of statistical information processing functions.

In some embodiments, a second process in the plurality of secondprocesses comprises one or more of the following: a function forcounting occurrences of distinct values in the corresponding subset ofintermediate data structures, a maximum value function for identifying amaximum value in the corresponding subset of intermediate datastructures, a minimum value function for identifying a minimum value inthe corresponding subset of intermediate data structures, a statisticalsampling function for applying a statistical function to thecorresponding subset of intermediate data structures, a function foridentifying values that occur most frequently in the correspondingsubset of intermediate data structures, and a function for estimating atotal number of unique values in the corresponding subset ofintermediate data structures.

In some embodiments, the applying the procedural language query to theparsed representation of the data record to extract the one or morevalues and the applying the respective emit operator to at least one ofthe one or more values to add the corresponding information to therespective intermediate data structure are performed independently foreach data record.

In some embodiments, the parsed representation of the data recordcomprises a key-value pair.

In some embodiments, the respective intermediate data structurecomprises a table having at least one index whose index values compriseunique values of the extracted one or more values. In some suchembodiments, the aggregating information from the subset of theintermediate data structures to produce the aggregated data combines theextracted one or more values having the same index values.

In some embodiments, the applying the procedural language query to theparsed representation produces a plurality of values, applying therespective emit operator to each of the produced plurality of values toadd corresponding information to the respective intermediate datastructure.

In some embodiments, the second plurality of processes are executing inparallel.

In some embodiments, the plurality of input data records comprises oneor more of the following types of data records: log files, transactionrecords, and documents.

In some embodiments, the respective intermediate data structurecomprises a table having a plurality of indices, wherein each of theplurality of indices is dynamically generated in accordance with theextracted one or more values.

Another aspect of the present disclosure provides a computer system withone or more processors and memory for analyzing a plurality of datarecords. The computer system comprising memory and one or moreprocessors. The memory stores instructions for executing a masterprocess that forms a procedure comprising initiating a plurality offirst processes. Each respective process of the plurality of firstprocesses is executed concurrently by the master process and comprises,for each data record in at least a subset of the plurality of input datarecords, creating a parsed representation of the data record, applying aprocedural language query to the parsed representation of the datarecord to extract one or more values, wherein the procedural languagequery is applied independently to each parsed representation, andapplying a respective emit operator to at least one of the extracted oneor more values to add corresponding information to a respectiveintermediate data structure, wherein the respective emit operatorimplements one of a predefined set of statistical information processingfunctions. The master process further initiates a plurality of secondprocesses. Each respective process of the plurality of second processesaggregates information from a corresponding subset of the intermediatedata structures to produce aggregated data. The computer implementedmethod further combines the produced aggregated data to produce outputdata.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a large-scale data processing model.

FIG. 2 is a block diagram of a large-scale data processing system.

FIG. 3 is a block diagram of a large-scale data processing system,including a master process for managing tasks.

FIG. 4 is a block diagram of a computer system for the data processingsystems shown in FIGS. 2 and 3.

FIG. 5 is a block diagram of a data distribution network for large-scaledata processing.

FIG. 6 is a flow diagram of an embodiment of a process for assigningtasks to processes.

FIG. 7A is a block diagram of an exemplary task status table.

FIG. 7B is a block diagram of an exemplary process status table.

FIG. 8 is a block diagram of an exemplary system for analyzing datarecords.

FIG. 9 is a flow diagram illustrating an exemplary method for analyzingdata records.

Like reference numerals refer to corresponding parts throughout theseveral views of the drawings.

DESCRIPTION OF EMBODIMENTS Large-Scale Data Processing Model

FIG. 1 is a block diagram of a large-scale data processing model 100.The model 100 generally includes mapping operations 102 and reductionoperations 104. The mapping operations 102 apply one or more mappingoperations to a set of input data α_(i) (e.g., text files, records,logs, sorted maps, etc.) to provide a set of intermediate data valuesβ_(i). The reduction operations 104 apply one or more reductionoperations to the set of intermediate data values β_(i) to provide a setof output data φ_(i) (e.g., tables, sorted maps, record I/O, etc.). Insome embodiments, the mapping operations 102 are implemented by one ormore application-specific mapping functions, which map a set of inputdata α_(i) to a set of intermediate data values β_(i). The intermediatedata values β_(i) or information corresponding to the intermediate datavalues are stored in one or more intermediate data structures. Someexamples of intermediate data structures include, without limitation,files, buffers, histograms, count tables and any other suitable datastructure or device for storing digital information. In someembodiments, the intermediate data values β_(i) are processed by thereduction operations 104, which are implemented by one or moreapplication-specific reduction functions, which reduce the set ofintermediate data values β_(i) to a set of output data φ_(i). In someembodiments, the intermediate data values β_(i) are processed by one ormore application-independent statistical information processingfunctions, which reduce the set of intermediate data values β_(i) to aset of output data φ_(i).

Distributed Data Processing System

In order to explain the operation of the large scale data processingsystem, it is helpful to consider an exemplary distributed dataprocessing system in which the large scale data processing is performed.In general, the embodiments described here can be performed by a set ofinterconnected processors that are interconnected by one or morecommunication networks.

FIG. 5 is a block diagram of an exemplary distributed data processingsystem 500. It should be appreciated that the layout of the system 500is merely exemplary and the system 500 may take on any other suitablelayout or configuration. The system 500 is used to store data, performcomputational tasks, and transmit data between datacenters DC1-DC4. Thesystem may include any number of data centers DCx, and thus the numberof data centers shown in FIG. 5 is only exemplary. The system 500 mayinclude dedicated optical links or other dedicated communicationchannels, as well as supporting hardware such as modems, bridges,routers, switches, wireless antennas and towers, and the like. In someembodiments, the system 500 includes one or more wide area networks(WANs) as well as multiple local area networks (LANs). In someembodiments, the system 500 utilizes a private network, i.e., the systemand its interconnections are designed and operated exclusively for aparticular company or customer. Alternatively, a public network may beused.

Some of the datacenters DC1-DC4 may be located geographically close toeach other, and others may be located far from the other datacenters. Insome embodiments, each datacenter includes multiple racks. For example,datacenter 502 (DC1) includes multiple racks 508 a, . . . , 508 n. Theracks 508 can include frames or cabinets into which components aremounted. Each rack can include one or more processors (CPUs) 510. Forexample, the rack 508 a includes CPUs 510 a, . . . ,510 n (slaves 1-16)and the nth rack 506 n includes multiple CPUs 510 (CPUs 17-32). Theprocessors 510 can include data processors, network attached storagedevices, and other computer controlled devices. In some embodiments, atleast one of processors 510 operates as a master processor, and controlsthe scheduling and data distribution tasks performed throughout thesystem 500. In some embodiments, one or more processors 510 may take onone or more roles, such as a master and/or slave. A rack can includestorage (e.g., one or more network attached disks) that is shared by theone or more processors 510.

In some embodiments, the processors 510 within each rack 508 areinterconnected to one another through a rack switch 506. Furthermore,all racks 508 within each datacenter 502 are also interconnected via adatacenter switch 504. As noted above, the present invention can beimplemented using other arrangements of multiple interconnectedprocessors.

Further details regarding the distributed network 500 of FIG. 5 can befound in U.S. patent application Ser. No. 10/613,626, entitled “Systemand Method For Data Distribution,” filed Jul. 3, 2003, which applicationis incorporated by reference herein in its entirety.

In another embodiment, the processors shown in FIG. 5 are replaced by asingle large-scale multiprocessor. In this embodiment, map and reduceoperations are automatically assigned to processes running on theprocessors of the large-scale multiprocessor.

Large-Scale Data Processing System I

FIG. 2 is a block diagram of a large-scale data processing system 200.The system 200 provides application programmers with anapplication-independent framework for writing data processing softwarethat can run in parallel across multiple different machines on adistributed network. The system 200 is typically a distributed systemhaving multiple processors, possibly including network attached storagenodes, that are interconnected by one or more communication networks.FIG. 2 provides a logical view of a system 200, which in someembodiments may be implemented on a system having the physical structureshown in FIG. 5. In one embodiment, the system 200 operates within asingle data center of the system 500 shown in FIG. 5, while in anotherembodiment, the system 200 operates over two or more data centers of thesystem 500.

As shown in FIG. 2, a set of input files 202 are processed by a firstset of processes 204, herein called map processes, to produce a set ofintermediate data, represented here by files 206. The intermediate data206 is processed by a second set of processes 208, herein called reduceprocesses, to produce output data 210. Generally each “map process” is aprocess configured (or configurable) to perform map functions and toexecute an application-specific map operator. Each “reduce process” is aprocess configured (or configurable) to perform reduce functions and toexecute an application-specific reduce operator. In some embodiments,the application-specific reduce operator includes or is replaced by oneor more application-independent statistical information processingfunctions. A control or supervisory process, herein called the workqueue master 214, controls the set of processing tasks. As described inmore detail below, the work queue master 214 determines how many maptasks to use, how many reduce tasks to use, which processes andprocessors to use to perform those tasks, where to store theintermediate data and output data, how to respond to any processingfailures, and so on.

It should be noted that the work queue master 214 assigns tasks toprocesses, and that multiple processes may be executed by each of theprocessors in the group of processors that are available to do the workassigned by the work queue master 214. In the context of FIG. 5 or anyother multiple processor system, the set of processes controlled by thework queue master 214 may be a subset of the full set of processesexecuted by the system, and furthermore the set of processors availableto do the work assigned by the work queue master 214 may be fewer thanthe full set of processors in the system. Some of the resources of thesystem may be used for other tasks, such as tasks that generate theinput data 202, or that utilize the output data 210. However, in someembodiments, some or all of the tasks that generate the input data 202or utilize the output data 210 may also be controlled or supervised bythe work queue master 214. In addition, in some embodiments processorscan be added or removed from the processing system during the executionof a map-reduce operation. The work queue master 214 keeps track of theprocessors in the system and the available processes executing on thoseprocessors.

Application programmers are provided with a restricted set ofapplication-independent operators for reading input data and generatingoutput data. The operators invoke library functions that automaticallyhandle data partitioning, parallelization of computations, faulttolerance (e.g., recovering from process and machine failures) and I/Oscheduling. In some embodiments, to perform a specific data processingoperation on a set of input files, the only information that must beprovided by an application programmer is: information identifying theinput file(s), information identifying or specifying the output files toreceive output data, and two application-specific data processingoperators, hereinafter referred to as map( ) and reduce( ) Generally,the map( ) operator specifies how input data is to be processed toproduce intermediate data and the reduce( ) operator specifies how theintermediate data values are to be merged or otherwise combined. Notethat the disclosed embodiments are not limited to any particular type ornumber of operators. Other types of operators (e.g., data filters) canbe provided, as needed, depending upon the system 200 architecture andthe data processing operations required to produce the desired,application-specific results. In some embodiments, the applicationprogrammers provide a partition operator, in addition to the map( ) andreduce( ) operators. The partition( ) operator, specifies how theintermediate data is to be partitioned over a set of intermediate files.

To perform large-scale data processing, a set of input files 202 aresplit into multiple data blocks 0, . . . , N-1 of either a specified orpredefined size (e.g., 64 MB). Alternately, in some embodiments theinput files 202 have a predefined maximum size (e.g., 1 GB), and theindividual files are the data blocks. A data block is a subset of datathat is retrieved during processing. In some embodiments, the datablocks are distributed across multiple storage devices (e.g., magneticor optical disks) in a data distribution network to fully utilize theaggregate storage space and disk bandwidth of the data processingsystem.

Referring to FIGS. 2 and 5, in some embodiments the input data files 202are stored in one or more data centers DC1-DC4. Ideally, the work queuemaster 214 assigns tasks to processors 510 in datacenters where theinput files are stored so as to minimize network traffic wheneverpossible. In some embodiments, the work queue master 214 uses input fileinformation received from a file system to determine the appropriateprocessor or process for executing a task, using a hierarchical decisionprocess. When a process in a processor in a datacenter DC1-DC4 is idle,it requests a task from the work queue master 214. The work queue master214 searches the input file information received from the file system(e.g., FS 446, FIG. 4), for an unprocessed data block on the machineassigned to process the task. If none are available, the work queuemaster 214 searches the file information for an unprocessed data blockon the same rack 508 as the machine assigned to process the task. Ifnone are available, the work queue master 214 searches the fileinformation for an unprocessed data block in the same datacenter as themachine assigned to process the task. If none are available, the workqueue master 214 will search for unprocessed blocks in otherdatacenters.

By using a hierarchical assignment scheme, data blocks can be processedquickly without requiring large volumes of data transfer traffic on thesystem 500. This in turn allows more tasks to be performed withoutstraining the limits of the system 500.

Task Management

Referring again to FIG. 2, application programmers develop the map( )and/or reduce( ) operators, which are computer programs that processinput data and intermediate, respectively. In some embodiments theseoperators are compiled into binary files 212 suitable for use on aparticular processing platform. The binary files 202 are loaded into awork queue master module 214, which manages jobs submitted by users ofthe system 200. In some embodiments, the work queue master 214 loads (orcauses to be loaded) onto each process to which it allocates a map orreduce task, the library procedures, and the map( ) or reduce( )operator required to perform the task assigned to the process.

The work queue master 214, when it receives a request to process a setof data using a specified set application-specific map( ) reduce( ) and,optionally, partition( ) operators, determines the number of map tasksand reduce tasks to be performed to process the input data. This may bebased on the amount of input data to be processed. For example, a jobmay include 10,000 map tasks and 10 reduce tasks. In some embodiments,the work queue master module generates a task status table havingentries representing all the tasks to be performed, and then beginsassigning those tasks to idle processes. As noted above, tasks may beallocated to idle processes based on a resource allocation scheme (e.g.,priority, round-robin, weighted round-robin, etc.).

Process and Task Status Tracking

FIG. 6 is a flow diagram of an embodiment of a process 600 for assigningtasks to processes. Process 600 parallelizes a data processing task overas many processes as is consistent with the available computingresources. While the process 600 described below includes a number ofsteps that appear to occur in a specific order, it should be apparentthat the process 600 steps are not limited to any particular order, and,moreover, the process 600 can include more or fewer steps, which can beexecuted serially or in parallel (e.g., using parallel processors or amulti-threading environment). Further, it should be noted that the stepsor acts in process 600 are application-independent and are implementedusing modules or instructions that are application-independent. Only theactual map and reduce operators, which produce intermediate data valuesfrom the input data and that produce output data from the intermediatedata values, respectively, are application-specific. Theseapplication-specific operators are invoked by the map and reduce tasksassigned to processes in step 610. By making a clear boundary betweenthe application-independent aspects and application-specific aspects ofperforming a large scale data processing operation, theapplication-independent aspects can be optimized, thereby making theentire large scale data processing operation very efficient. As notedabove, in some embodiments, the application-specific reduce operator isreplaced by one or more application-independent statistical informationprocessing functions.

The process 600 begins by determining if there are tasks waiting to beassigned to a process (step 606). If there are no tasks waiting, thenthe process 600 waits for all the tasks to complete (step 604). If thereare tasks waiting, then the process 600 determines if there are any idleprocesses (step 608). If there are idle processes, then the process 600assigns a waiting task to an idle process (step 610) and returns to step606. If there are no idle processes, the process 600 waits for an idleprocess (step 614). Whenever a process completes a task, the processsends a corresponding message to the work queue master 214, whichupdates the process and task status tables (step 612). The work queuemaster 214 may then assign a new task to the idle process, if it has anyunassigned tasks waiting for processing resources. For reduce tasks, thework queue master 214 may defer assigning any particular reduce task toan idle process until such time that the intermediate data to beprocessed by the reduce task has, in fact, been generated by the maptasks. Some reduce tasks may be started long before the last of the maptasks are started if the intermediate data to be processed by thosereduce tasks is ready for reduce processing.

In some embodiments, whenever a process fails, which may be discoveredby the work queue master 214 using any of a number of known techniques,the work queue master 214 (A) determines what task was running in thefailed process, if any, (B) assigns that task to a new process, waitingif necessary until an idle process becomes available, and (C) updatesits process and task status tables accordingly. In some embodiments, thework queue master 214 may undertake remedial measures (step 602), suchas causing the failed process to be restarted or replaced by a newprocess. In some embodiments, the work queue master may further detectwhen such remedial measures fail and then update its process statustable to indicate such failures. In addition, in some embodiments, whena map task fails and is restarted in a new process, all processesexecuting reduce tasks are notified of the re-execution so that anyreduce task that has not already read the data produced by the failedprocess will read the data produced by the new process.

FIG. 7A shows an exemplary task status table for keeping track of thestatus of map and reduce tasks. In some embodiments, each task (e.g.,map, reduce) is assigned task ID, a status, a process, and one or moreinput files and output files. In some embodiments, the input files fieldmay specify a portion of an input file (e.g., where the portioncomprises a data block) to be processed by the task, or this field mayspecify portions of two of more input files. The status field indicatesthe current status of the task (e.g., waiting, in-progress, completed,or failed), which is being performed by the assigned process identifiedin the process field. The process retrieves data from one or more inputfiles (or the one or more input file portions) identified in the inputfile field and writes the results of the task ID to one or more outputfiles identified in the output file field. For example, in FIG. 7A, taskRed0000 is assigned to process P0033, which is still in progress. Theprocess P0033 retrieves data blocks from input file 12340 (e.g.,intermediate file A, FIG. 2) and writes the results of the task tooutput file 14000. In some embodiments, until a task is assigned to aprocess, the process field in the task status table indicates that noprocess has yet been assigned to perform that task. It should beapparent that there could be more or fewer fields in the task statustable than shown in FIG. 7A, such as multiple fields for identifyingoutput and input files.

FIG. 7B shows a process status table for keeping track of the status ofall the processes to which the work queue master 214 can assign tasks.In some embodiments, each process is assigned to a task and a location.In some embodiments, each process is permanently assigned to aparticular location (i.e., a particular processor). The status fieldindicates the current status of the process, which performs the assignedtask at the assigned location. For example, process P0001 is “Busy”performing task Map0001 on location CPU011. It should be apparent thatthere could be more or fewer field in the process status table thanshown in FIG. 7B, such as assigning multiple locations assigned to asingle task (e.g., parallel processing).

Map Phase

In some embodiments, the set of application-specific data processingoperations that the map( ) operator can perform is constrained. Forexample, in some embodiments, the map( ) operator may be required toprocess the input data one record at a time, proceeding monotonicallyfrom the first record to the last record in the data block beingprocessed. In some embodiments, the map( ) operator may be required togenerate its output data in the form of key/value pairs. Either the keyor value or both can comprise structured data, as long as the data canbe encoded into a string. For example, the key may have multiple parts,or the value may have multiple parts.

By requiring the map( ) operator's output to be in the form of key/valuepairs, the resulting intermediate data can be mapped to a set ofintermediate data files in accordance with a partition( ) operator. Anexemplary partition( ) operator may specify that all intermediate datais to be directed to an intermediate file corresponding to the value ofthe first byte of the key. Another exemplary partition( ) operator mayspecify that all intermediate data is to be directed to an intermediatefile corresponding to the value of the function “hash(Key) modulo N”,where N is a value specified by the application programmer and“hash(Key)” represents the value produced by applying a hash function tothe key of the key/value pairs in the intermediate data. In someembodiments, the partition operator is always a modulo function and theapplication programmer only specifies the modulus to be used by themodulo function. In one embodiment, the partition operator isautomatically selected by the work queue master 214, or by one of theapplication-independent library functions, discussed below.

In some embodiments, the data blocks 0, . . . , N-1 are automaticallyassigned to map tasks (executed by map processes 204-0, . . . , 204-N-1)in an application independent manner, by the work queue master 214. Inparticular, the work queue master 214 is configured to determine thenumber of data blocks to be processed, and to create a correspondingnumber of instances of the map process 204. Stated in another way, thework queue master 214 assigns a corresponding number of map tasks toprocesses, as suitable processes become available. Since the number ofmap tasks may exceed the number of processes available to the work queuemaster 214, the work queue master 214 will assign as many map tasks asit can to available processes, and will continue to assign the remainingmap tasks to processes as the processes complete previously assignedtasks and become available to take on new tasks. The work queue master214 uses the task status table and process status tables, describedabove, to coordinate its efforts.

Reduce Phase

Reduce modules 208 read intermediate data values (e.g., key/value pairs)from the intermediate files 206. In some embodiments, each reduce module208 reads from only one intermediate file 206. The reduce modules 208sort the intermediate data values, merge or otherwise combine sortedintermediate data values having the same key and then write the key andcombined values to one or more output files 210. In some embodiments,the intermediate file 206 and the output files 210 are stored in a FileSystem (FS), which is accessible to other systems via a distributednetwork. In some embodiments described below, the reduce phase executesone or more application-specific reduce operators to perform the datamerging or combining operation. In an embodiment described below, thedata merging or combining operation is performed by one or moreapplication-independent reduce operators, but the selection of whichreduce operator(s) to use for any particular data processing operationis application specific.

Software Implementation

In some embodiments, the map and reduce modules 204 and 208 areimplemented as user-defined objects with methods to carry outapplication-specific processing on data using known object orientedprogramming techniques. For example, a MapReduction base class can becreated that includes methods and data for counting the number of inputfiles that contain a particular term or pattern of terms, sorting theresults of the sort, eliminating duplicates in the sorted results andcounting the number of occurrences of the term. Application programmerscan derive other classes from the base class and instantiate the baseclass as an object in the application code to access its data andmethods.

Large-Scale Data Processing System II

While the system 200 provides good performance for many large-scale dataprocessing, the performance of the system 200 may diminish as the amountof data to be processed and thus the number of tasks increases. Forinstance, performance may be diminished when the size of the data blocksis decreased, thereby increasing the number of map tasks. Since theintermediate files 206 are stored in the FS, an increase in tasksresults in an increase in intermediate file access requests and anassociated increase in network traffic. Additionally, a single workqueue master 214 can only handle a limited number of task assignmentsper time period, beyond which the work queue master 214 begins to limitsystem performance. Increasing the size of those tasks to accommodateadditional jobs could result in load imbalances in the system 200. Theseperformance issues are addressed in the system 300, which is describedbelow with respect to FIG. 3.

FIG. 3 is a block diagram of a large-scale data processing system 300,including a master process 320 (sometimes called a supervisory process)for managing tasks. In system 300, one or more master processes 320assign one or more tasks to one or more worker processes 304 and 308. Insome embodiments, the master process 320 is a task itself (e.g., task 0)initiated by the work queue master module 314 and is responsible forassigning all other tasks (e.g., mapping and reducing tasks) to theworker processes 304, 308, in a master/slave type relationship. Theworker processes 304, 308 include two or more process threads, each ofwhich can be invoked based on the particular task assigned to it by themaster process 320. For example, each worker process 304 invokes a mapthread to handle an assigned map task and invokes a reduce thread tohandle an assigned reduce task. In one embodiment, the worker processes304, 308 include one or more additional threads. For example, a distinctthread may be used to receive remote procedure calls (e.g., from themaster process) and to coordinate work done by the other threads. Inanother example, a distinct thread may be used to handle remote readrequests received from other processors (i.e., peers) in the system.

In one embodiment, the number of worker processes is equal to the numberof machines available in the system 300 (i.e., one worker process permachine). In another embodiment, two or more worker processes are usedin each of the machines in the system 300. If a worker process fails,its task is reassigned to another worker process by the master process320. In some embodiments, the master process 320 or the work queuemaster 314 may undertake remedial measures to repair, restart or replacea failed worker process.

In some embodiments, when the work queue master 314 receives amap/reduce data processing job, the work queue master 314 allocates thejob to a master process 320. The master process 320 determines thenumber (M) of map tasks and the number (R) of reduce tasks to beperformed, and then makes a request to the work queue master 314 for M+Rprocesses (M+R+1, including the master process 320) to be allocated tothe map/reduce data processing job. The work queue master 314 respondsby assigning a number of processes to the job, and sends thatinformation to the master process 320, which will then manage theperformance of the data processing job. If the number of processesrequested exceeds the number of processes available, or otherwiseexceeds the number of processes that the work queue master 314 isallowed to assign to the job, the number of processes assigned to thejob will be less than the number requested.

In some embodiments, all R of the reduce tasks are all immediatelyassigned to processes, but the reduce tasks do not begin work (e.g., ondata sorting) until the master process 320 informs them that there areintermediate files ready for processing. In some embodiments, a singleworker process 304/308 can be assigned both a map task and a reducetask, simultaneously (with each being executed by a distinct processthread), and therefore assigning reduce tasks to processes at thebeginning of the job does not reduce the throughput of the system.

Map Phase

The division of input files 302 into data blocks 0, . . . , N-1, may behandled automatically by the application independent code. Alternately,the user may set an optional flag, or specify a parameter, so as tocontrol the size of the data blocks into which the input files aredivided. Furthermore, the input data may come from sources other thanfiles, such as a database or in-memory data structures.

The input data blocks 0, . . . , N-1, which may in some embodiments betreated as key/value pairs, are read by application independent workerprocesses 304-0, . . . , 304-N-1, as shown in FIG. 3. The input files302 can include a variety of data types typically used in dataprocessing systems, including without limitation text files, record I/O,sorted data structures (such as B-trees), tables and the like. Each ofthe worker processes 304 to which a map task has been assigned appliesthe application-specific map( ) operator to the respective input datablock so as generate intermediate data values. The intermediate datavalues are collected and written to one or more intermediate files 306,which are stored locally at the machine (e.g., in one or more localdatabases) in which the worker process 304 is executed. The intermediatefiles 306 are retained (i.e., they are persistent) until the reducephase completes. Note that in some embodiments, each of the intermediatefiles 306 receives output from only one worker process 304, as shown inFIG. 3. When a worker process 304 completes its assigned task, itinforms the master process 320 of the task status (e.g., complete orerror). If the task was successfully completed, the worker process'sstatus report is treated by the master process 320 as a request foranother task.

In some embodiments, if there are enough worker processes 304 that allthe intermediate values can be held in memory across the workerprocesses, then the system need not write any data to files on localdisks. This optimization reduces execution time for map-reduceoperations in which the number of worker processes is sufficient tohandle all the map tasks at once, and the amount of intermediate data issufficiently small to be kept in memory.

Application-Specific Combiner Function

In some cases, there is significant repetition in the intermediate keysproduced by each map task, and the application-specific Reduce functionis both commutative and associative. When all these conditions apply, aspecial optimization can be used to significantly reduce execution timeof the map-reduce task. An example of a situation in which theoptimization can be applied is a map-reduce operation for counting thenumber of occurrences of each distinct word in a large collection ofdocuments. In this example, the application-specific map function(sometimes called the map( ) operator elsewhere in this document)outputs a key/value pair for every word w in every document in thecollection, where the key/value pair is <w, 1>. The application-specificreduce function (sometimes called the reduce( ) operator elsewhere inthis document) for this example is:

input data is “values”;

int result=0; // initialize result to zero

for each v in values:

-   -   result+=ParseInt(v);

output: <key, result>

Each map task in this example will produce hundreds or thousands ofrecords of the form <word, 1>. The Reduce function simply adds up thecount values. To help conserve network bandwidth for map-reduceoperations that satisfy these properties, the user may provide anapplication-specific Combiner function or operator. The Combinerfunction is invoked with each unique intermediate key and a partial setof intermediate values for the key. This is similar to the Reducefunction, except that it gets executed at the end of each Map task bythe same machine and process that performed by Map task. The Combinerfunction partially summarizes the intermediate key/value pairs. In fact,when using a Combiner function, the same function is typically specifiedfor the Combiner and Reduce operations. The partial combining performedby the Combiner operation significantly speeds up certain classes ofMap-Reduce operations, in part by significantly reducing the amount ofinformation that must be conveyed from the processors that handle Maptasks to processors handling Reduce tasks, and in part by reducing thecomplexity and computation time required by the data sorting and Reducefunction performed by the Reduce tasks.

Reduce Phase

Application independent worker processes 308 which have been assignedreduce tasks read data from the locally stored intermediate files 306.In some embodiments, the master process 320 informs the worker processes308 where to find intermediate data files 306 and schedules readrequests for retrieving intermediate data values from the intermediatedata files 306. In some embodiments, each of the worker processes 308reads a corresponding one of the intermediate files 306 produced by allor a subset of the worker processes 304. For example, consider a systemin which each of the worker processes 304 assigned a map task outputs M(e.g., 100) intermediate files, which we will call Partion-1,j throughPartition-M,j, where j is an index identifying the map task thatproduced the intermediate files. The system will have 100 workerprocesses 308, Worker-1 to Worker-M, each of which reads a correspondingsubset of the intermediate files, Partition-pj for all valid values of“j,” produced by the worker processes 304, where “p” indicates thepartition assigned to a particular worker process Worker-P (304) and “j”is an index identifying the map tasks that produced the intermediatefiles.

Each worker process 308 sorts the intermediate data values in the subsetof the intermediate files read by that worker process in accordance withthe key of the key/value pairs in the intermediate data. The sorting ofthe key/value pairs is an application independent function of the reducethreads in the worker processes 308. Each worker process 308 also mergesor otherwise combines the sorted intermediate data values having thesame key, and writes the key and combined values to one or more outputfiles 310. The merging or other combining operation performed on thesorted intermediate data is performed by an application-specific reduce() operator. In some embodiments, the application-specific reduce( )operator is implemented using one or more application-independentstatistical information processing functions. The selection of whichapplication-independent statistical information processing functions touse, and the data to which these functions are to be applied, however,is application-specific, and in fact depends on which statisticalinformation processing functions are used by the application-specificmap operator. In some embodiments, the output files 310 are stored in aFile System, which is accessible to other systems via a distributednetwork. When a worker process 308 completes its assigned reduce task,it informs the master process 320 of the task status (e.g., complete orerror). If the reduce task was completed successfully, the workerprocess's status report is treated by the master process 320 as arequest for another task. If the reduce task failed, the master process320 reassigns the reduce task to another worker process 308.

Recovering From Task and Processor Failures

In some embodiments, the master process 320 is configured to detect taskand processor failures. When a task failure is detected, the masterprocess 320 reassigns the task to another process. In some embodiments,the master process 320 redistributes the work of the failed task over alarger number of tasks so as to complete that task more quickly than bysimply re-executing the task on another process. The master processsubdivides the work assigned to the failed task to a plurality of newlymini-tasks, and then resumes normal operation by assigning themini-tasks to available processes. The number of mini-tasks may be apredefined number, such as a number between 8 and 32, or it may bedynamically determined based on the number of idle processes availableto the master process. In the case of a failed map task, division of thework assigned to the failed task means assigning smaller data blocks tothe mini-tasks. In the case of a failed reduce task, division of thework assigned to the failed task may mean assigning the data sortingportion of the reduce task to a larger number of worker processes,thereby performing a distributed sort and merge. The resulting sorteddata may, in some embodiments, be divided into a number of files orportions, each of which is then processed using the reduce( ) operatorto produce output data. By detecting such failures and taking theseremedial actions, the amount of delay in completing the entire dataprocessing operation is significantly reduced.

When a processor failure is detected by the master process 320, it maybe necessary to re-execute all the tasks that the failed processorcompleted as well as any tasks that were in process when the processorfailed, because the intermediate results produced by map tasks arestored locally, and the failure of the processor will in many cases makethose results unavailable. Using the status tables, described above, themaster process 320 determines all the tasks that ran on the processor,and also determines which of those tasks need to be re-executed (e.g.,because the results of the tasks are unavailable and are still needed).The master process 320 then updates its status tables to indicate thatthese identified tasks are waiting for assignment to worker tasks.Thereafter, re-execution of the identified tasks is automaticallyhandled using the processes and mechanisms described elsewhere in thisdocument.

In some embodiments, an additional mechanism, herein called backuptasks, is used to guard against task failures as well as task slowdowns. One of the main problems that lengthens the total time taken fora map-reduce operation to complete is the occurrence of “straggler”tasks or machines. A straggler is a process or machine that takes anunusually long time to complete one of the last few map or reduce tasksin the computation. Stragglers can arise for many reasons, includingboth hardware and software errors or conditions. When a large map-reduceoperation is divided into thousands of map and reduce tasks executed bythousands of processes, the risk of a straggler task occurring issignificant. The use of backup tasks, as described next, effectivelyguards against stragglers, without regard to the cause of the problemcausing a process or machine to run slowly. In these embodiments, themaster process determines when the map-reduce operation is close tocompletion. In one embodiment, the criteria for being close tocompletion is that the percentage of map tasks that have completed isabove a threshold. In another embodiment, the criteria for being closeto completion is that the percentage of map and reduce tasks, takentogether, that have completed is above a threshold. The threshold can beany reasonably number, such as 95, 98, or 99 percent, or any percentageabove 90 percent. Once the master process determines that the map-reduceoperation is close to completion, the master process schedules backupexecutions of all remaining tasks. These duplicate tasks may be calledbackup map tasks and backup reduce tasks. FIG. 7A shows an exemplarybackup task, Map103b, in the task status table. Each task is marked ascompleted when either the primary or backup execution completes. Thismechanism obviously increases the computational resources, and thus insome embodiments the criteria for invoking this mechanism are selectedso as to increase the computational resources by no more than a fewpercent (e.g., five percent). The use of backup tasks significantlyreduces the time to complete large map-reduce operations, often by morethan twenty-five percent.

Master Process & Status Tables

The master process 320 is responsible for assigning tasks to the workerprocesses 304 and 308 and for tracking their status and output.Periodically, the master process 320 solicits a report from each workerprocess assigned a task to determine its task status. In someembodiments, the report can be solicited using a polling scheme (e.g.,round-robin). If the task status indicates that the worker process hasfailed, then the task is put back in the appropriate task queue to bereassigned to another worker process. In some embodiments, the masterprocess 320 maintains status tables 326 for managing tasks, as describedwith respect to FIGS. 7A and 7B.

In one embodiment in which more than one master process 320 is used, alocking mechanism is used to ensure that each of the entries of thestatus tables is modified by only one of the master processes at any onetime. Whenever a master process 320 attempts to assign a map or reducetask to a process, or perform any other management of a map or reducetask, the master process first acquires (or attempts to acquire) a lockon the corresponding status table entry. If the lock is refused, themaster process concludes that the map/reduce task is being managed byanother master process and therefore the master process looks foranother map/reduce task to manage. In another embodiment, the taskstatus table is divided into portions, with each master process beinggiven ownership of a corresponding portion of the task status table, andresponsibility for managing the map/reduce tasks in that portion of thetask status table. Each master process can read other portions of thetask status table, but only uses information in entries indicating thatthe corresponding task has been completed. 100751 The system 300provides several advantages over other systems and methods by using oneor more master processes to assign and manage tasks, together with localdatabases to store intermediate results produced by the tasks. Forexample, by distributing file reads over multiple local databases moremachines can be used to complete tasks faster. Moreover, since smallertasks are spread across many machines, a machine failure will result inless lost work and a reduction in the latency introduced by suchfailure. For example, the FS load for system 200 is O(M*R) file opensand the FS load for system 300 is O(M) input file opens+O(R) output fileopens, where M is the number of map tasks and R is the number of reducetasks. Thus, the system 200 requires significantly more file system fileopen operations than the system 300.

Computer System for Large-Scale Data Processing

FIG. 4 is a computer system 400 for the data processing systems 200 and300 shown in FIGS. 2 and 3. The computer system 400 generally includesone or more processing units (CPUs) 402, one or more network or othercommunications interfaces 410, memory 412, and one or more communicationbuses 414 for interconnecting these components. The system 400 mayoptionally include a user interface 404, for instance a display 406 anda keyboard 408. Memory 412 may include high speed random access memoryand may also include non-volatile memory, such as one or more magneticdisk storage devices. Memory 412 may include mass storage that isremotely located from the central processing unit(s) 402.

The memory 412 stores an operating system 416 (e.g., LINUX or UNIX), anetwork communication module 418, a system initialization module 420,application software 422 and a library 430. The operating system 416generally includes procedures for handling various basic system servicesand for performing hardware dependent tasks. The network communicationmodule 418 is used for connecting the system 400 to a file system (FS)446, servers or other computing devices via one or more communicationnetworks, such as the Internet, other wide area networks, local areanetworks, metropolitan area networks, and the like. The systeminitialization module 420 initializes other modules and data structuresstored in memory 414 required for the appropriate operation of thesystem 400. In some embodiments, the application software 422 includes amap operator 424, a reduce operator 426 and a partition operator 428,and the library 430 includes application-independent map functions 432,reduce functions 434, and partition functions 436. As discussed above,the application software 422 may also include a combiner operator 425when the map-reduce operation meets certain conditions. The functions,procedures or instructions in the library 430 handle the applicationindependent aspects of large scaled data processing jobs, while theapplication software 422 provides the application-specific functions forproducing output data. The application software 422 may include sourceprograms for the map, combiner, reduce and partition operators as wellas the corresponding compiled programs, represented by binary files 212and 312 in FIGS. 2 and 3, respectively.

One or more status tables 444 are also included to track tasks andprocesses, as described with respect to FIGS. 7A and 7B. In someembodiments, the computer system 400 includes worker processes 438,intermediate files 440, and one or more master process(es) 442. Theinteraction of worker processes 438 and master processes 442 weredescribed with respect to FIG. 3.

Referring to FIGS. 2, 3 and 4, an application programmer can create ascript or program using the application software 422, which includes oneor more operators 424, 426 and 428. The script or program is processedinto binary files 212, 312 and provided to the work queue master 214,314.

For the embodiment shown in FIG. 2, input files 202 are split intomultiple data blocks and assigned by the work queue master 214 toindividual, application independent map and reduce processes 204 and208. The processes 204 invoke map functions 432 to process the inputdata (e.g., counting the number of occurrences of a term) to provideintermediate data values. In some embodiments, the input data isstructured in the form of key-value pairs. The partition function 436partitions the map output into one or more intermediate files 440, whichare stored on the FS 446. The intermediate data values are processed bythe map and reduce processes 204 and 208, which invoke reduce functions208 for sorting and combining intermediate data values having the samekey, and for storing the key and values in one or more output files 210located on the FS 446. The work queue master 214 manages the map andreduce processes 204 and 208 with the assistance of status tables 444,as described with respect to FIGS. 7A and 7B.

For the embodiment shown in FIG. 3, input files 302 are split intomultiple data blocks and assigned by the master process 442 toindividual, application independent worker processes 438. The workerprocesses 438 invoke map functions 432 for operating on blocks of inputdata (e.g., counting the number of occurrences of a term) to provideintermediate data values. The partition function 436 partitions the mapoutput into one or more intermediate files 440, which are stored locallyin memory 412. The intermediate data values are processed by applicationindependent worker processes 438, which invoke reduce functions 434 forsorting and combining intermediate data values having the same key, andfor storing the resulting output data in one or more output files 310located on the file system 446. The master process 442 manages theworker processes 436 with the assistance of status tables 444, asdescribed with respect to FIGS. 7A and 7B.

Analyzing Data Records

FIG. 8 is a block diagram of an exemplary system for analyzing datarecords. Only the aspects of FIG. 8 that are different from FIG. 4 aredescribed next. In particular, the application software 802 of system800 includes an application script 804, which is executed during the mapphase, and the system 800 also includes an Application Library 810. Theapplication script 804 includes one or more table definitions, a query(also called a data extraction program or script), and one or more emitinstructions (each of which invokes an emit operator). For convenience,the terms “application script” and “query” are sometimes usedinterchangeably in this document. The “query” being discussed here isused to extract data or values from a set of records, and isdistinguished from a “search query” for identifying documents in adatabase or on the Internet that contain a specified set of query terms.The table definitions specify the type of statistical information to beaccumulated when a set of records are processed by the applicationscript 804. The query extracts zero or more items of information fromeach record, and the emit instructions cause information to be added tothe tables. The emit instructions may be considered to be part of orembedded in the query.

The Application Library 810 is a set of application independentprocedures 812. In one embodiment, each of the application libraryprocedures includes at least an emit operator 814 and a reduce operator816. The emit operator 814 for each statistical procedure includesinstructions for evaluating data values provided to the emit operatorand, when appropriate, updating the information stored in acorresponding table or other data structure (herein called a “table” forease of explanation) for accumulating the statistical informationcorresponding to the statistical procedure. Some values provided to theemit operator may be discarded by the emit operator, after analysis ofthose values, because they provide no information required to be storedin the corresponding table. In some cases, the emit operator 814 maystore information corresponding to, but not equal to, a value providedto the emit operator. For instance, an emit operator may increment acount value at a particular index in a table in response to acorresponding value being provided to the emit operator by theapplication script 804. Furthermore, this is an example of dataaggregation that occurs during the map phase.

The reduce operator 816 for each application independent procedure 812combines the intermediate data produced by multiple map tasks so as toproduce a final set of results. The manner in which intermediate data iscombined is specific to each type of procedure 812 and thus eachapplication independent procedure 812 has an associated reduce operator.For example, for one application, values having matching index valuesare summed. In another application, the values for each index areinspected to identify unique index values, and a list of the uniqueindex values is generated.

FIG. 9 is a flow diagram illustrating an exemplary method for analyzingdata records. At 910, groups of records 905 are allocated to a firstplurality of processes, such as processes 915 and 945, which areprocesses operating in parallel. In some embodiments, the allocation isdone in an application independent manner, for example by using process600.

Records 905 can be, without limitation, log files, transaction records,documents, or virtually any other kind of data records. Records 905 canbe in ASCII, binary, or any other file type. Records 905 can includeboth real-time data and off-line data.

In FIG. 9, the steps shown in process 1 (915) are exemplary of the stepsthat occur in each respective process 915 of the first plurality ofprocesses for each record 920 in the group of records allocated to therespective process.

In some embodiments, if record 920 is unstructured, a parsedrepresentation of record 920 is created prior to applying a query at925. In some embodiments, the parsed representation of record 920comprises one or more key-value pairs.

At 925, an application-dependent query is applied to record 920 (or tothe parsed representation of record 920) to extract or produce zero ormore values 930.

In some embodiments, query 925 is applied independently to each record920 (or to the parsed representation of record 920). For such queries,the analysis of each record 920 is stateless, i.e., no state informationneeds to be passed from the processing of one record 920 to the nextrecord. Thus, the values 930 produced by a query 925 that is appliedindependently to each record 920 depend on the content of the record 920being queried, but do not depend on the contents of other records.

In some embodiments, query 925 is a procedural language query, i.e., aquery written as an explicit sequence of steps to apply to record 920 toproduce zero or more values. Table 1 provides a pseudo code example ofan application script 804, which includes a query written in aprocedural language. Although the word “query” is singular, it should beclear that one query 925 on record 920 can include multiple queries(sometimes called sub-queries) about the contents of record 920. Thus,multiple aspects of record 920 can be analyzed in one query 925.

TABLE 1 Pseudo Code Example of Application Script, Including Query /*Define Tables */ Table1: table sum[query:string] of count:int Table2:table top(100) of query:string weight millisec:int Table3: tablesum[language:string] of count:int /* Apply the following query to eachrecord */ When (record satisfies specified condition)  {  /* Extractinformation from one record */  produce value1 from record;  producevalue2 from record;  produce value3 from record;  produce value4 fromrecord;  /* Emit information to tables */  emit Table1[value1] <- 1; emit Table2[value2] <- value3 weight value4;  emit Table2[value1] <-value3 weight value4;  emit Table3[value3] <- 1;  If (predefinedcondition regarding one or more of the produced values)   {   emitTable1 [value4] <- 1;   produce value5 from record;   emitTable3[value5] <- value4;   }   } /* End of query */

The values 930 produced by the querying 925 of record 920 can take avariety of forms, including, without limitation, Boolean values, arraysof unsigned bytes, integers, floating point values, integralrepresentations of time, hash values, compound structures, arrays, andstrings (e.g., arrays of Unicode characters). The values 930 may betemporarily stored in local memory until processing of the currentrecord is complete. In some embodiments, the values produced arerepresented by key-value pairs.

At 935, zero or more emit operators are applied to each of the zero ormore produced values 930 so as to add corresponding information to oneor more intermediate data structures 940.

In some embodiments, emit operator 935 is one of a set of predefinedapplication-independent statistical information processing functions,such as one of the operators in emit operators library 965. Each of theemit operators can be thought of as a function that produces a table ofvalues. Furthermore, each such table of values can be indexed using asfew or as many indices as the user defines in the application-specificmap operator. For each distinct value of the index, or each distinct setof index values (when the table has more than one index), the emitoperator produces an associated set of values. For instance, if an emitoperator is configured to produce the top 5 values of a set of values,and the table to which it stores data is configured (by the mapoperator) to be indexed by a single index, then the emit operator willproduce the top 5 values for each distinct value of the index. If thetable has two indexes (e.g., TopTable[index1][index2]), then the emitoperator will produce the top five values for each distinct pair ofindex values.

Exemplary emit operators include, without limitation: Collection 970, acollection or concatenation of extracted values (sometimes herein calleddata values); Max 972, a sample of the N highest-weighted items orvalues per index; Min 974, a sample of the N lowest-weighted items orvalues; Sample 976, a statistical sampling of N values; Set 978, a set(unique elements) containing at most N items or values per index; Sum980, an arithmetic sum of data values; Top 982, a statistical estimatorfor the ‘most frequent N’ items or values; Histogram 983, whichdetermines the number of occurrences of each distinct value; Quantile984, which sorts values and determines break points between N tiles(e.g., quartiles for N=4, percentiles for N=100) based on thedistribution of the values; and Unique 985, a statistical estimator forthe total number of unique items or values. These functions specifyparticular methods for aggregating the values 930 obtained from the datarecord queries (e.g., query 925).

In some embodiments, when applying query 925 to record 920 produces aplurality of values 930, each respective process 915 of the firstplurality of processes includes applying a respective emit operator 935to each (or at least a subset) of the produced values 930 so as to addcorresponding information to a corresponding intermediate data structureof a plurality of intermediate data structures.

In some embodiments, each intermediate data structure 940 comprises atable having one or more indices. An index (sometimes called a key) canbe, without limitation, a time, a number, or a string, therebypermitting the table to be indexed by time, numeric order, oralphabetical order. Indexing the tables by time permits answers totime-series questions (e.g., historical plots) to be easily generated.

In some embodiments, intermediate data structure 940 is a table having aplurality of indices, wherein at least some of the indices aredynamically generated in accordance with the produced values 930. Inother words, the index values for which data is stored in the table aredynamically generated from the produced values. For example, if thetable is defined to be indexed by an ASCII string, each value of whichrepresents the name of a language, LangTable[language: string], then thevalues of the index will be determined dynamically based on the languagenames extracted from the records processed by the system. An example ofa table having two indices is LangTable[language:string][day:int], where“day” represents the day of a week (1 to 7), month (1 to 31) or year (1to 365). This table can be used to count queries for each distinctlanguage on each day of a week, month or year. The index values foreither or both of the two indices may be dynamically generated, oralternately could be statically generated when the table is initialized.There need not be any system imposed limit on the number of indices thatcan be defined for a particular table.

At 955, information from a plurality of intermediate data structures 940is aggregated to produce output data 960. In some embodiments, theaggregating combines values 930 having the same index values. Each indexvalue may be considered to be the key in a key-value pair. In someembodiments, output data 960 are a final set of tables.

In some embodiments, aggregation is performed by a plurality of secondprocesses executing in parallel (e.g., process 208 or process 308). Insome embodiments, in each respective process of the second plurality ofprocesses, information is aggregated from a plurality of theintermediate data structures 940 to produce output data 960. The outputdata 960 may include multiple tables of aggregated output data,including one table for each table defined in the application script(804, FIG. 8).

In some embodiments, once output data 960 have been produced, a secondquery can be run on output data 960. If output data 960 are a set ofrecords, these records can serve as the input records 905 for a secondquery using the process illustrated in FIG. 9. For example, a firstquery 925 followed by a first emit operator 935 could generate acollection 970 of phone calls from phone logs and produce output data960 in the form of a table of records indexed by phone number. Eachrecord contains information concerning phone calls to or from a distinctphone number. Consequently, a second query and emit operator(s) can beapplied to each of these records according to the process shown in FIG.9.

Examples of Data Record Analysis

The following pseudo code query (Table 2) analyzes web server logs (“WSlogs”) for the number of searches (sometimes herein called web searches)for images coming from Japanese language users. For these searches byJapanese language users, the query also determines the 100 mostCPU-intensive searches.

TABLE 2 /* Input WS logs. Parse each log based on the description ofsuch logs in */ /* WSLogEntryParse, which is defined in the file“”wslog.parse”. */ parse “wslog.parse” /* Declare and initialize thevariable log_record. */ /* The type is WSLogEntryParse defined in“wslog.parse”. */ /* The value, which is reinitialized for each inputrecord, is generated by implicit */ /* conversion (parsing) of the inputrecord to that type. */ log_record: WSLogEntryParse = input; /* Create atable to count the searches. */ japanimagesearch: table sum [search:string] of count: integer /* Create an object for the 100 such searchesthat took the most total time (aggregate) */ /* to serve. */japanimagetoptime: table top(100) of search: string weight millisec:integer; /* Define some helper variables, which are reinitialized foreach record. */ search: string = log_record.search; request: string =log_record.request; language: string = log_record.searchlang;elapsedtime: integer = log_record.elapsedtime; When (  /* Look for loglines whose language field is Japanese and whose request is for the */ /* image server. */  match (“{circumflex over ( )}ja:”, language) andmatch (“{circumflex over ( )}GET /images”, request) ) {  /* Count thisrecord. */  emit japanimagesearch[search] <- 1;  /* Track how much timeit took to serve. */  emit japanimagetoptime <- search weightelapsedtime; }

Each intermediate data structure 940 (e.g., a table) is used by one ormore corresponding emit operators to gather and process values 930emitted to it and store the results in indexed storage locations. Eachemit operator (e.g., collection 970, max 972, etc.) knows how toaggregate the values 930 passed to it.

To show the usefulness of indices, the following example considersqueries that count the number of web searches for various singers (e.g.,Britney Spears, Madonna, etc.) A data structure 940 with no index, suchas

numbritneyqueries: table sum of integer;

can only count the number of web searches for one singer. On the otherhand, adding indices to the tables permits more sophisticated queries.For example, the following data structure can be used to count thenumber of web searches for many different singers:

numdivaqueries: table sum [string] of integer;

This table is indexed by strings (e.g., the names of different singers,“britney,” “madonna,” etc.). Each entry in the table stores an integer(e.g., the number of web searches for the corresponding singer). Forthis data structure, an emit operator, such as

emit numdivaqueries [“britney”]<−1

will aggregate the integer 1 to the table numdivaqueries indexed by thestring “britney”. Since the numdivaqueries table is configured to storesums, the effect of the emit operator example shown above is to add 1 tothe count of “britney” web queries.

Each time an index value is used in an emit operation, the cell to storeits value will be created if it does not already exist in thecorresponding table.

Other exemplary types of data structures 940 (e.g., tables) foraggregating query values 930 include:

/* Collect all the web searches into a single stream. */ allsearches:table collection of string; /*Count the number of times each web searchis seen. */ numsearches: table sum [search: string] of count: integer;/* Record the top 10 web searches for each country. */ topsearches:table top (10) [country: string] of search: string weight count:integer; /* Record the ten most remunerative web searches. */ bigmoney:table maximum (10) [search: string] of search: string weight revenue:float; /* Count how many unique web searches using an (internal) sampledtable of 10,000 */ /* entries to estimate the distribution. */uniquesearches: table unique (10000) of search: string; /* Gather up toten distinct search strings for each distinct cookie */ session: tableset (10) [cookie: string] of search: string;

The following pseudo code query (Table 3) illustrates the use of indicesand aggregation to answer the question “How many web searches are madein each language?” for a given set of log records 905.

TABLE 3 /* Declare the table indexed by the name of the language tostore the results. */ searchesbylanguage: table sum[language:string] ofcount: integer; /* For each record, parse the input record into thevariable ‘log_record’. */ log_record: LogRecord = input; /* Discover thelanguage of the search by doing some processing on the search, */ /*here represented schematically by a call to the fictitious function‘language_of’. */ lang: string = language_of (log_record.search); /*Create an event that records that there was a search in the logs thatwas in this particular language. */ emit searchesbylanguage[lang] <- 1;

As shown in Table 1 and Table 2 above, a more complex query wouldcontain more aspects of a procedural language: ‘if’ statements, loops,local variables, etc. This query is deliberately simple for clarity.

This example (i.e., the query shown in Table 3) has a table(searchesbylanguage) indexed by the string representing the name of thelanguage in the search. The system creates these indexed strings ondemand. That is, the size of the table and the size of the strings to beused as indices do not need to be predeclared; the running of the querygenerates the appropriate indices and these table entries (for“english”, “thai”, “japanese”, etc.) are synthesized on demand.

In some embodiments, the events emitted by running the process on eachrecord are collected on each processor where the process ran. Eventscollected on a given processor can be aggregated there for efficiency,to reduce the computation and bandwidth required to assemble the finaltable, e.g., output data 960. For instance, if our sample process runson three processors, the counts can be accumulated on each processor, soafter the query has been applied to all the records, there are in effectmini-tables on each processor, such as:

processor1:

-   -   searchesbylanguage[“chinese”]=72041    -   searchesbylanguage[“english”]=411520    -   searchesbylanguage[“russian”]=123426

processor2:

-   -   searchesbylanguage[“chinese”]=67129    -   searchesbylanguage[“english”]=421526    -   searchesbylanguage[“russian”]=170126

processor3:

-   -   searchesbylanguage[“chinese”]=95397    -   searchesbylanguage[“english”]=401521    -   searchesbylanguage[“russian”]=52126

The final phase aggregates 955 these individual tables element byelement to construct the final table 960, such as:

searchesbylanguage[“chinese”]=234567

searchesbylanguage[“english”]=1234567

searchesbylanguage[“russian”]=345678

In some embodiments, the final aggregation is done independently foreach table, and furthermore final aggregation may be done independentlyfor different indices (or groups of indices) of a table. For example,the final value for “english” can be determined on a separate processfrom the final value for “spanish.”

. . .

The foregoing description, for purpose of explanation, has beendescribed with reference to specific embodiments. However, theillustrative discussions above are not intended to be exhaustive or tolimit the invention to the precise forms disclosed. Many modificationsand variations are possible in view of the above teachings. Theembodiments were chosen and described in order to best explain theprinciples of the invention and its practical applications, to therebyenable others skilled in the art to best utilize the invention andvarious embodiments with various modifications as are suited to theparticular use contemplated.

We claim:
 1. A computer-implemented method of analyzing a plurality ofdata records, comprising: executing a master process that forms aprocedure comprising: (A) initiating a plurality of first processes,wherein each respective process of the plurality of first processes isexecuted concurrently by the master process and comprises: for each datarecord in at least a subset of the plurality of data records: splittingthe plurality of data records into a plurality of data blocks;independently applying map functions to each of the plurality of datablocks to generate intermediate data; and partitioning the intermediatedata between a plurality of intermediate files distributed across aplurality of local databases; (B) initiating a plurality of secondprocesses, wherein each respective process of the plurality of secondprocesses aggregates information from a subset of the intermediate datato produce aggregated data; wherein the computer implemented methodfurther combines the produced aggregated data to produce output data. 2.The method of claim 1, wherein each process in the plurality of firstprocesses is compiled into a binary file prior to execution.
 3. Themethod of claim 1, wherein each process in the plurality of firstprocesses is implemented as a user defined object in accordance with anobject oriented programming technique.
 4. The method of claim 1, whereineach process in the plurality of first processes is implemented as auser defined object that is derived from a base class in accordance withan object oriented programming technique.
 5. The method of claim 1,wherein the initiating the plurality of first process comprises creatinga respective object in a plurality of object for each first process inthe plurality of first processes.
 6. The method of claim 1, wherein theindependently applying map functions are executed at the plurality oflocal databases.
 7. The method of claim 6, wherein a number of the mapfunctions applied to the plurality of data blocks is sufficient to storeall intermediate data generated by the map functions at the plurality oflocal databases.
 8. The method of claim 1, wherein a second process inthe plurality of second processes comprises one or more of thefollowing: a function for counting occurrences of distinct values in thecorresponding subset of intermediate data structures, a maximum valuefunction for identifying a maximum value in the corresponding subset ofintermediate data structures, a minimum value function for identifying aminimum value in the corresponding subset of intermediate datastructures, a statistical sampling function for applying a statisticalfunction to the corresponding subset of intermediate data structures, afunction for identifying values that occur most frequently in thecorresponding subset of intermediate data structures, and a function forestimating a total number of unique values in the corresponding subsetof intermediate data structures.
 9. The method of claim 1, wherein theintermediate data is structured as key-value pairs.
 10. The method ofclaim 1, wherein the intermediate data comprises a table having at leastone index whose index values comprise one or more values extracted fromthe plurality of data blocks by the map functions.
 11. The method ofclaim 10, wherein the aggregation of information from the subset of theintermediate data structures to produce the aggregated data combines theextracted one or more values having the same index values.
 12. Themethod of claim 1, further comprising executing the plurality of secondprocesses in parallel.
 13. The method of claim 1, wherein the pluralityof data records comprises one or more of the following types of datarecords: log files, transaction records, and documents.
 14. The methodof claim 1, wherein the intermediate data comprises a table having aplurality of indices, wherein each of the plurality of indices isdynamically generated in accordance with a corresponding one or morevalues extracted from the plurality of data blocks by the map functions.15. A computer system with one or more processors and memory foranalyzing a plurality of data records, the computer system comprisingmemory and one or more processors, wherein the memory storesinstructions for executing a master process that forms a procedurecomprising: (A) initiating a plurality of first processes, wherein eachrespective process of the plurality of first processes is executedconcurrently by the master process and comprises: for each data recordin at least a subset of the plurality of data records: splitting theplurality of data records into a plurality of data blocks; independentlyapplying map functions to each of the plurality of data blocks togenerate intermediate data; and partitioning the intermediate databetween a plurality of intermediate files distributed across a pluralityof local databases; (B) initiating a plurality of second processes,wherein each respective process of the plurality of second processesaggregates information from a subset of the intermediate data to produceaggregated data; wherein the computer implemented method furthercombines the produced aggregated data to produce output data.
 16. Thecomputer system of claim 15, wherein each first process in the pluralityof first processes is implemented as a user defined object in accordancewith an object oriented programming technique.
 17. A non-transitorycomputer readable storage medium storing one or more programs, the oneor more programs for executing a master process that forms a procedure,which when executed by a computer system, causes the computer system to:(A) initiate a plurality of first processes, wherein each respectiveprocess of the plurality of first processes is executed concurrently bythe master process and comprises: for each data record in at least asubset of the plurality of data records: split the plurality of datarecords into a plurality of data blocks; independently apply mapfunctions to each of the plurality of data blocks to generateintermediate data; and partition the intermediate data between aplurality of intermediate files distributed across a plurality of localdatabases; (B) initiate a plurality of second processes, wherein eachrespective process of the plurality of second processes aggregatesinformation from a subset of the intermediate data to produce aggregateddata; wherein the computer implemented method further combines theproduced aggregated data to produce output data.
 18. The non-transitorycomputer readable storage medium of claim 17, wherein each first processin the plurality of first processes is implemented as a user definedobject in accordance with an object oriented programming technique. 19.The computer system of claim 17, wherein the initiating the plurality offirst processes comprises creating a respective object in a plurality ofobject for each first process in the plurality of first processes. 20.The non-transitory computer readable storage medium of claim 19, whereinthe initiating the plurality of first processes comprises creating arespective object in a plurality of objects for each first process inthe plurality of first processes.